A critical authentication flaw in the ManageWP Worker plugin allows unauthenticated attackers to perform session hijacking, potentially leading to a full site takeover.

This vulnerability involves improper authentication, where the plugin fails to bind login signatures to specific accounts and does not implement replay protection for login links. This permits an unauthenticated attacker who intercepts a valid login link to assume the identity of any user, including those with administrative privileges.

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress site. Because the flaw allows session hijacking of administrative accounts, an attacker could exfiltrate sensitive data, modify site content, install malicious plugins, or pivot to further compromise the underlying server infrastructure. With a CVSS score of 8.1, the high severity reflects the potential for total system compromise and unauthorized data access.

Immediate Action: Update the ManageWP Worker plugin to version 4.9.37 or later immediately to resolve the authentication signature deficiency.

Proactive Monitoring: Review access logs for unusual login patterns or multiple sessions originating from unexpected IP addresses that correlate with administrative account access.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block suspicious requests targeting authentication endpoints while the update is being staged.

Public Exploit Available: No

Given the high CVSS score and the ability for an attacker to gain administrative access without credentials, this vulnerability poses a severe risk to site integrity and data security. Administrators should prioritize updating the ManageWP Worker plugin immediately to version 4.9.37. If an immediate update is not feasible, restrict access to the site management interface or consider disabling the plugin until the patch can be applied to prevent potential session hijacking.